Sync TUI, Guardian, and CI substrate #308

Objective

Complete the convergence program by adopting compatible upstream TUI, Guardian/approval-review lifecycle, app-server presentation, generated client, packaging, and CI changes after their protocol, state, auth, and tool dependencies are stable.

Finish Line

The Codex Lab TUI/Desktop-facing lifecycle and build pipeline are aligned with the selected upstream substrate, preserve Every Code product UX, and produce a provenance-visible binary that passes the final dogfood gates.

Current Status

State: Complete.

PR #495 merged into #428's candidate as 5ae93aee76aca2f498150f9a5dd3cc70f4633612 on July 29, 2026. It restores the owned, bounded codex exec Background Review wait and records the current Auto Review and Guardian suites as converged upstream evidence while preserving Background Review as a distinct Every Code workflow.

Final lane evidence on exact source dd231f3560199d6afcc60d109030002bb312d12d: all 148 codex-exec tests, 3,312 TUI tests, 296 app-server-protocol tests, 137 focused initialize/thread/app-list/review/interrupt/strict-config app-server tests, and all seven restored exec-harness scenarios passed. Schema regeneration produced no diff. The exact debug binary recorded clean provenance and digest 6deaf6a50e59971f89fdaf91432087cee64a0970fd95defc9d34e77f46e26f24. PR #495's 15 checks were terminal and green, including blocking CI and the macOS ARM64 app build. Strict convergence validation passed with 366 guarded paths, zero violations, zero stale waivers, and four reproducible historical snapshots.

A broader non-required app-server sweep passed 1,061 of 1,068 tests. Four failures were caused by fixture binaries not built by the package-only invocation; the remaining executor/host-skill failures are routed to downstream #83's paired skills-quality audit rather than hidden as #308 lifecycle failures.

Next action: activate #83 on candidate head 5ae93aee76aca2f498150f9a5dd3cc70f4633612 and resolve its exact skills-quality evidence.

Blocked by: nothing.
Last verified: July 29, 2026.

Scope

• In: TUI rendering and lifecycle, tab/diff behavior, account/agent/review/validation surfaces, Guardian interruption/idle semantics, app-server notifications, generated clients, packaging, macOS app build, and CI workflows.
• Out: redefining Guardian as code review, replacing Every Code account/agent UX with upstream defaults, and landing generated or CI churn before owning source behavior is stable.

Acceptance Criteria

• TUI changes follow the settled protocol/core/auth/tool contracts and preserve Every Code account, agent, Code Bridge, Background Review, and validation UX.
• Guardian remains approval and safety review; interrupted turns emit the correct terminal and idle lifecycle without hanging clients.
• Current compatible upstream leaf fixes, including diff-tab rendering, are adopted or explicitly rejected in Define Every Code-owned convergence contracts #126.
• Strict app-server/Desktop clients handle all new lifecycle variants and notifications.
• Generated schemas, clients, snapshots, lockfiles, and packaging outputs are regenerated from final source state.
• The launch/install path exposes exact build provenance so dogfood evidence cannot come from a stale binary.
• Focused TUI snapshots, app-server lifecycle tests, exec harness, macOS ARM64 app build, and required CI pass.
• Final dogfood covers foreground Review, Background Review, Approval Review, validation, Code Bridge, accounts, and external agents as distinct workflows.

Relationships

• Parent: Sync Codex Lab with current openai/codex substrate #230.
• Candidate: Build upstream snapshot integration and canary branch #428.
• Contract authority: Define Every Code-owned convergence contracts #126.
• Blocked by: Sync canonical turn, context, history, and recovery substrate #305, Sync subscription auth and multi-account substrate #306, and Sync exec, tools, sandbox, and external-agent substrate #307.
• Completed provenance prerequisite: Make dogfood build provenance visible #311.
• Related: Adopt Background Review terminology across product surfaces #303 terminology migration, Restore Every Code auto-validation loop #284 validation integration, and Rework durable Background Review around upstream review primitives #231 Background Review architecture.
• Blocks: Audit codex-skills inside Codex Lab dogfood #83 and Cut over to converged Codex Lab baseline and primary harness #343.

Validation

• TUI snapshot and interaction tests.
• App-server protocol/schema and lifecycle integration tests.
• Full Desktop Compatibility Gate from codex-rs/app-server/README.md: regenerate schema, prove the schema path has no diff or untracked files, run just test -p codex-app-server-protocol, and run the targeted app-server initialize/thread/app-list plus CLI strict-config tests.
• Exec-harness scenario sweep and macOS ARM64 app build.
• Repository-required CI and regenerated-artifact checks.
• Rebuilt-current-binary dogfood with exact Make dogfood build provenance visible #311 commit provenance.

Decisions

• Guardian is approval safety, not the general code-review findings engine.
• CI/generated/package changes land last, after source contracts settle.

Open Questions

• Which upstream TUI additions are product-compatible versus reference-only for Every Code UX.